Log in Start free

Vulnerability · Published Jun 1, 2026 · Assigned by apache

CVE-2026-46605Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Medium 4.3

In plain English

A medium-severity security flaw in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12activemqno fix listedDEBIAN-CVE-2026-46605
Debian:13activemqno fix listedDEBIAN-CVE-2026-46605
Mavenorg.apache.activemq:apache-activemq5.19.7GHSA-cpw7-g3p5-qrfq
Mavenorg.apache.activemq:apache-activemq6.2.6GHSA-cpw7-g3p5-qrfq
Ubuntu:24.04:LTSactivemqno fix listedUBUNTU-CVE-2026-46605
Ubuntu:25.10activemqno fix listedUBUNTU-CVE-2026-46605
Ubuntu:26.04:LTSactivemqno fix listedUBUNTU-CVE-2026-46605
Ubuntu:26.10activemqno fix listedUBUNTU-CVE-2026-46605

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache ActiveMQ Broker 0 – before 5.19.76.0.0 – before 6.2.6
Apache Software Foundation Apache ActiveMQ All 0 – before 5.19.76.0.0 – before 6.2.6
Apache Software Foundation Apache ActiveMQ 0 – before 5.19.76.0.0 – before 6.2.6

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References